Luke/sept16 CVE (#4094)

dependancy bump and version bump. mainly to resolve the crit in deepdif

---------

Co-authored-by: cragwolfe <crag@unstructured.io>

Author: luke-kucing

CHANGELOG.md

@@ -1,4 +1,4 @@
-## 0.18.15-dev1
+## 0.18.15
 
 ### Enhancements
 - Speed up function ElementHtml._get_children_html by 234% (codeflash)
@@ -8,6 +8,9 @@
 
 ### Fixes
 
+- Bumped dddependencies via pip-compile to address the crit CVE in:
+  - deepdiff: 8.6.0 -> 8.6.1: GHSA-mw26-5g2v-hqw3
+    
 ## 0.18.14
 
 ### Enhancements

requirements/base.txt

@@ -140,11 +140,11 @@ typing-inspect==0.9.0
     #   unstructured-client
 unstructured-client==0.25.9
     # via
-    #   -c ././deps/constraints.txt
+    #   -c ./deps/constraints.txt
     #   -r ./base.in
 urllib3==2.5.0
     # via
-    #   -c ././deps/constraints.txt
+    #   -c ./deps/constraints.txt
     #   requests
     #   unstructured-client
 webencodings==0.5.1

requirements/extra-paddleocr.txt

@@ -30,7 +30,7 @@ charset-normalizer==3.4.3
     # via
     #   -c ./base.txt
     #   requests
-cython==3.1.3
+cython==3.1.4
     # via unstructured-paddleocr
 exceptiongroup==1.3.0
     # via
@@ -109,13 +109,13 @@ pillow==11.3.0
     #   paddlepaddle
     #   scikit-image
     #   unstructured-paddleocr
-protobuf==6.32.0
+protobuf==6.32.1
     # via
-    #   -c ././deps/constraints.txt
+    #   -c ./deps/constraints.txt
     #   paddlepaddle
 pyclipper==1.3.0.post6
     # via unstructured-paddleocr
-pydantic==2.11.7
+pydantic==2.11.9
     # via albumentations
 pydantic-core==2.33.2
     # via pydantic
@@ -153,7 +153,7 @@ soupsieve==2.8
     # via
     #   -c ./base.txt
     #   beautifulsoup4
-stringzilla==4.0.6
+stringzilla==4.0.10
     # via albucore
 termcolor==3.1.0
     # via fire
@@ -180,6 +180,6 @@ unstructured-paddleocr==2.10.0
     # via -r ./extra-paddleocr.in
 urllib3==2.5.0
     # via
-    #   -c ././deps/constraints.txt
     #   -c ./base.txt
+    #   -c ./deps/constraints.txt
     #   requests

requirements/extra-pdf-image.txt

@@ -62,15 +62,15 @@ googleapis-common-protos==1.70.0
     # via
     #   google-api-core
     #   grpcio-status
-grpcio==1.74.0
+grpcio==1.75.0
     # via
     #   google-api-core
     #   grpcio-status
-grpcio-status==1.74.0
+grpcio-status==1.75.0
     # via google-api-core
-hf-xet==1.1.9
+hf-xet==1.1.10
     # via huggingface-hub
-huggingface-hub==0.34.4
+huggingface-hub==0.35.0
     # via
     #   accelerate
     #   timm
@@ -145,12 +145,12 @@ pdf2image==1.17.0
     # via -r ./extra-pdf-image.in
 pdfminer-six==20250327
     # via
-    #   -c ././deps/constraints.txt
+    #   -c ./deps/constraints.txt
     #   -r ./extra-pdf-image.in
     #   unstructured-inference
 pi-heif==1.1.0
     # via -r ./extra-pdf-image.in
-pikepdf==9.10.2
+pikepdf==9.11.0
     # via -r ./extra-pdf-image.in
 pillow==11.3.0
     # via
@@ -164,9 +164,9 @@ proto-plus==1.26.1
     # via
     #   google-api-core
     #   google-cloud-vision
-protobuf==6.32.0
+protobuf==6.32.1
     # via
-    #   -c ././deps/constraints.txt
+    #   -c ./deps/constraints.txt
     #   google-api-core
     #   google-cloud-vision
     #   googleapis-common-protos
@@ -190,7 +190,7 @@ pycparser==2.23
     # via
     #   -c ./base.txt
     #   cffi
-pyparsing==3.2.3
+pyparsing==3.2.4
     # via matplotlib
 pypdf==6.0.0
     # via
@@ -251,7 +251,7 @@ timm==1.0.19
     #   unstructured-inference
 tokenizers==0.21.4
     # via
-    #   -c ././deps/constraints.txt
+    #   -c ./deps/constraints.txt
     #   transformers
 torch==2.8.0
     # via
@@ -274,6 +274,7 @@ transformers==4.55.4
 typing-extensions==4.15.0
     # via
     #   -c ./base.txt
+    #   grpcio
     #   huggingface-hub
     #   onnx
     #   pypdf
@@ -286,8 +287,8 @@ unstructured-pytesseract==0.3.15
     # via -r ./extra-pdf-image.in
 urllib3==2.5.0
     # via
-    #   -c ././deps/constraints.txt
     #   -c ./base.txt
+    #   -c ./deps/constraints.txt
     #   requests
 wrapt==1.17.3
     # via

requirements/extra-pptx.txt

@@ -12,5 +12,5 @@ python-pptx==1.0.2
     # via -r ./extra-pptx.in
 typing-extensions==4.15.0
     # via python-pptx
-xlsxwriter==3.2.5
+xlsxwriter==3.2.9
     # via python-pptx

requirements/huggingface.txt

@@ -25,9 +25,9 @@ fsspec==2025.9.0
     # via
     #   huggingface-hub
     #   torch
-hf-xet==1.1.9
+hf-xet==1.1.10
     # via huggingface-hub
-huggingface-hub==0.34.4
+huggingface-hub==0.35.0
     # via
     #   tokenizers
     #   transformers
@@ -88,7 +88,7 @@ sympy==1.14.0
     # via torch
 tokenizers==0.21.4
     # via
-    #   -c ././deps/constraints.txt
+    #   -c ./deps/constraints.txt
     #   transformers
 torch==2.8.0
     # via -r ./huggingface.in
@@ -107,6 +107,6 @@ typing-extensions==4.15.0
     #   torch
 urllib3==2.5.0
     # via
-    #   -c ././deps/constraints.txt
     #   -c ./base.txt
+    #   -c ./deps/constraints.txt
     #   requests

requirements/test.txt

@@ -32,15 +32,15 @@ flake8-print==5.0.0
     # via -r ./test.in
 freezegun==1.5.5
     # via -r ./test.in
-grpcio==1.74.0
+grpcio==1.75.0
     # via -r ./test.in
 iniconfig==2.1.0
     # via pytest
 liccheck==0.9.2
     # via -r ./test.in
 mccabe==0.7.0
     # via flake8
-mypy==1.17.1
+mypy==1.18.1
     # via -r ./test.in
 mypy-extensions==1.1.0
     # via
@@ -66,7 +66,7 @@ pycodestyle==2.14.0
     # via
     #   flake8
     #   flake8-print
-pydantic==2.11.7
+pydantic==2.11.9
     # via -r ./test.in
 pydantic-core==2.33.2
     # via pydantic
@@ -83,15 +83,15 @@ pytest==8.4.2
     #   pytest-xdist
 pytest-cov==7.0.0
     # via -r ./test.in
-pytest-mock==3.15.0
+pytest-mock==3.15.1
     # via -r ./test.in
 pytest-xdist==3.8.0
     # via -r ./test.in
 python-dateutil==2.9.0.post0
     # via
     #   -c ./base.txt
     #   freezegun
-ruff==0.12.12
+ruff==0.13.0
     # via -r ./test.in
 semantic-version==2.10.0
     # via liccheck
@@ -112,7 +112,7 @@ types-click==7.1.8
     # via -r ./test.in
 types-markdown==3.9.0.20250906
     # via -r ./test.in
-types-requests==2.32.4.20250809
+types-requests==2.32.4.20250913
     # via -r ./test.in
 types-tabulate==0.9.0.20241207
     # via -r ./test.in
@@ -121,6 +121,7 @@ typing-extensions==4.15.0
     #   -c ./base.txt
     #   black
     #   exceptiongroup
+    #   grpcio
     #   mypy
     #   pydantic
     #   pydantic-core
@@ -129,6 +130,6 @@ typing-inspection==0.4.1
     # via pydantic
 urllib3==2.5.0
     # via
-    #   -c ././deps/constraints.txt
     #   -c ./base.txt
+    #   -c ./deps/constraints.txt
     #   types-requests

unstructured/__version__.py

@@ -1 +1 @@
-__version__ = "0.18.15-dev1"  # pragma: no cover
+__version__ = "0.18.15"  # pragma: no cover